From 0e724df6b77b15d6c6ae3bcc3699b060fbcb5849 Mon Sep 17 00:00:00 2001
From: Keith Patrick <keithy@consultant.com>
Date: Sun, 8 Mar 2026 23:12:23 +0000
Subject: [PATCH] fix(security): allow PICOCLAW_SERVICE_NAME in default
 allowlist

---
 pkg/tools/shell/env.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkg/tools/shell/env.go b/pkg/tools/shell/env.go
index 4887a791a..1b4409b6e 100644
--- a/pkg/tools/shell/env.go
+++ b/pkg/tools/shell/env.go
@@ -34,6 +34,7 @@ var DefaultEnvAllowlist = map[string]bool{
 	"HTTP_PROXY":   true,
 	"HTTPS_PROXY":  true,
 	"NO_PROXY":     true,
+	"PICOCLAW_SERVICE_NAME": true,
 }
 
 // defaultEnvAllowPrefixes are env var prefixes that are always allowed.